Skip to main content
Glama

ChatGPT Box MCP

English | 简体中文

A private MCP server that lets ChatGPT create and operate your own Box by ASCII Linux environments.

The control direction is deliberately one-way:

ChatGPT
  → private Developer Mode MCP app
  → OpenAI Secure MCP Tunnel
  → this local MCP server
  → Box Public API
  → your Box Linux environments

ChatGPT remains the conversational interface and tool orchestrator. This project does not automate the ChatGPT website, extract ChatGPT responses, expose a ChatGPT account as an API, or call Box's built-in Codex/Claude prompt runner.

What it can do

The server exposes explicit, accurately annotated MCP tools:

Area

Tools

Discovery

box_list, box_get, box_list_events

Lifecycle

box_create, box_stop, box_resume, box_fork

Work

box_execute_command, box_read_file, box_write_file

Long-running work

box_job_start, box_job_status, box_job_logs, box_job_cancel

Visual inspection

box_open_desktop

Short commands wait for at most 60 seconds, matching the Box command API. Background jobs run independently inside the Box and persist their pid, status, and logs under .chatgpt-box-mcp/jobs/ in the Box work directory.

Related MCP server: GPT Harness

Safety model

  • BOX_API_KEY is read only from the MCP server's environment. It is never a tool argument or tool result.

  • Tool descriptions and MCP annotations state which actions write, may destroy data, or affect external systems.

  • File tools reject absolute paths and .. traversal segments.

  • Long-job scripts are base64 encoded before being installed in the Box, so their contents are not interpolated into the launcher shell.

  • A forced stop is marked destructive because it can lose changes since the last successful snapshot.

  • Desktop URLs are secret-bearing. The tool tells ChatGPT not to log, persist, or share them.

  • HTTP mode binds to loopback by default. Binding to a non-loopback address requires MCP_HTTP_TOKEN.

The server deliberately does not expose Box account secret-management or API-key-management endpoints.

Requirements

Developer Mode and tunnel permissions are separate. Availability depends on your ChatGPT workspace/plan and OpenAI Platform organization permissions.

Install

npm.cmd install
npm.cmd run build
Copy-Item .env.example .env

Edit .env and set:

BOX_API_KEY=box_your_secret_here

Do not commit .env.

Run locally over stdio:

npm.cmd run start:env

The process waits for an MCP client on stdin/stdout. Log messages go to stderr so they do not corrupt the MCP stream.

Connect through OpenAI Secure MCP Tunnel

  1. Create a tunnel in OpenAI Platform tunnel settings and associate it with the ChatGPT workspace that will use it.

  2. Download the latest tunnel-client.

  3. Use an absolute path for the MCP command. On Windows, for example:

$env:CONTROL_PLANE_API_KEY = "sk-your-runtime-key"

tunnel-client init `
  --sample sample_mcp_stdio_local `
  --profile chatgpt-box `
  --tunnel-id tunnel_replace_me `
  --mcp-command 'node --env-file=D:\Chat-box-mcp\.env D:\Chat-box-mcp\dist\src\index.js'

tunnel-client doctor --profile chatgpt-box --explain
tunnel-client run --profile chatgpt-box

Keep tunnel-client run healthy while using the app.

  1. Open ChatGPT Plugins, create a developer-mode app, choose Tunnel, and select the tunnel.

  2. Scan the tools and name the private app, for example ChatGPT Box MCP.

You can then ask:

@ChatGPT Box MCP list my running boxes.

@ChatGPT Box MCP create a one-hour small box, clone this repository,
run the tests, fix the failures, and show me the diff. Use a background
job if the work will take more than a minute.

ChatGPT should explain and confirm consequential tool calls according to the tool annotations and the current product policy.

Local HTTP mode and MCP Inspector

HTTP mode is useful for MCP Inspector and local diagnostics.

Set these values in .env:

MCP_TRANSPORT=http
MCP_HOST=127.0.0.1
MCP_PORT=3000

Then run:

npm.cmd run start:env

Endpoints:

  • MCP: http://127.0.0.1:3000/mcp

  • Health: http://127.0.0.1:3000/healthz

If you intentionally bind beyond loopback, also set a strong MCP_HTTP_TOKEN and send it as Authorization: Bearer .... A public plugin needs additional authentication, deployment, and review work; this repository is designed for a private, manually configured Developer Mode app.

Development

npm.cmd run check
npm.cmd test

The tests cover Box request construction, structured API errors, credential isolation, long-job launcher safety, job status parsing, MCP initialization, tool discovery, and the missing-credential error path.

Operational notes

  • Box creation, resume, and fork operations can start billable machine time.

  • box_stop snapshots before stopping unless force=true is explicitly requested.

  • Cancelling a background job sends SIGTERM to its process group. It cannot roll back files or external side effects already produced.

  • Box API command output may itself be truncated by Box; large MCP results are also capped to protect the conversation context.

  • The MCP server does not retain ChatGPT conversations or Box API responses.

Disclaimer

Unofficial project. Not affiliated with, endorsed by, or supported by OpenAI or Dedale/ASCII. Users configure and operate their own ChatGPT account, OpenAI tunnel, Box account, credentials, environments, and permissions.

Use this project only for systems and resources you are authorized to access. Review the current OpenAI terms and Box terms for your use case.

Available Tools

15 tools
box_createCreate Box environmentA

Provision a paid Box Linux environment owned by the configured Box account. This changes external state and starts billable runtime.

ParametersJSON Schema
NameRequiredDescriptionDefault
sizeNodefault
no_envNoCreate an isolated box without account secrets or credentials.
ttl_secondsNoAutomatic archival delay. null disables auto-stop.

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses that the operation is billable ('starts billable runtime') and changes external state, adding important cost and side-effect context beyond the readOnlyHint=false annotation. It also clarifies ownership by the configured Box account.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the core purpose and cost implication. No unnecessary detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

While the description covers purpose and cost, it does not describe what the tool returns (e.g., an environment ID) or how parameters affect provisioning. Since there is no output schema, this information is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description does not mention any of the three parameters (size, no_env, ttl_seconds). Schema coverage is 67%, but the size parameter lacks a description, and the tool description does not compensate by explaining parameter options or trade-offs.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses the verb 'Provision' and specifies the resource as a 'paid Box Linux environment owned by the configured Box account,' clearly distinguishing it from managing or inspecting existing environments (e.g., box_get, box_stop). It is specific and action-oriented.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies this tool is for creating a new environment but does not explicitly state when to choose it over alternatives like box_fork, which could also create environments. No exclusions or selection criteria are provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

box_execute_commandExecute Box commandA
Destructive

Run a shell command inside a Box and wait up to 60 seconds. The command may modify files, install software, access configured credentials, or affect external systems. Use box_job_start for longer work.

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdNo
box_idYes
commandYes
timeout_secondsNo

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes beyond annotations by detailing specific side effects: 'may modify files, install software, access configured credentials, or affect external systems'. It also discloses the 60-second wait behavior. Annotations already label it destructive/open-world, but the description adds concrete context, significantly enhancing transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, both earning their place. The first states the core action and timeout; the second warns of side effects and points to an alternative. No fluff, front-loaded with the primary purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers purpose, side effects, and alternative, but lacks parameter semantics (cwd, timeout) and return-value expectations. No output schema exists, so the 0% parameter coverage leaves gaps. It's adequate for deciding whether to use the tool, but not fully complete for correct invocation without schema inspection.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It implicitly indicates 'command' is the shell command and 'box_id' is the Box, but gives no explanation for 'cwd' or 'timeout_seconds'. The timeout is implied by 'wait up to 60 seconds' but not tied to the parameter. Parameter meanings are largely left to inference.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Run a shell command inside a Box and wait up to 60 seconds' — a specific verb and resource. It distinguishes itself from sibling tool box_job_start by noting the alternative for longer work, making its purpose unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says 'Use box_job_start for longer work', providing a direct when-not-to-use and naming the alternative. The description also implies this is for short-to-medium commands (wait up to 60 seconds), giving clear context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

box_forkFork BoxA

Create a new paid Box from an existing snapshot. The source Box is not modified.

ParametersJSON Schema
NameRequiredDescriptionDefault
sizeNoOmit to inherit the source size.
box_idYes
no_envNo

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds meaningful behavioral context beyond annotations: it explicitly guarantees the source Box is not modified, and notes the new Box is 'paid,' which has billing implications. This complements the destructiveHint false annotation without contradicting it.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, zero fluff. The core purpose and a key behavioral trait are stated concisely, with the most important information front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the core action and a key behavioral guarantee, but lacks usage guidance and parameter details. Given the tool has 3 parameters and no output schema, the description is only partially complete for effective agent decision-making.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description only hints at the role of box_id (as the source snapshot) but does not explain the 'size' or 'no_env' parameters. With only 33% schema description coverage, the description should compensate but fails to add significant parameter-level meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Create a new paid Box') and the specific source ('from an existing snapshot'), which distinguishes it from siblings like box_create. It also adds the important note that the source is not modified, further refining its purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage context (when you need a new box based on an existing snapshot) but does not explicitly state when to use this over alternatives like box_create. No exclusions or conditions are given, so guidance is implied rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

box_getGet Box environmentA
Read-only

Inspect one Box environment after create, stop, resume, or fork operations.

ParametersJSON Schema
NameRequiredDescriptionDefault
box_idYes

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, covering the safety profile. The description adds timing context but no additional behavioral traits such as return format or potential errors. It is consistent with annotations, so no contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence of 12 words, front-loaded with the action and resource, and includes necessary context. No filler or redundant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only getter with one parameter and clear annotations, the description is mostly complete. It could mention what is returned, but the annotations and tool name provide sufficient context for an agent to select and invoke it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has one parameter, box_id, with a pattern but no description (0% coverage). The description does not elaborate on the parameter beyond implying it identifies the environment, so it does not compensate for the missing schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Inspect one Box environment' with a specific verb and resource. It also provides lifecycle context ('after create, stop, resume, or fork operations'), which distinguishes it from sibling tools like box_list.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear when-to-use context by specifying the operations after which inspection is appropriate. It does not explicitly name alternatives or exclusion criteria, but the timing context is sufficiently informative for a single-resource getter.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

box_job_cancelCancel background jobA
Destructive

Send SIGTERM to a running background job and its process group. Partial file or external changes are not rolled back.

ParametersJSON Schema
NameRequiredDescriptionDefault
box_idYes
job_idYes

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (readOnlyHint=false, destructiveHint=true), the description reveals the mechanism (SIGTERM to process group) and warns that partial file/external changes are not rolled back. This adds valuable context about side effects and non-reversibility, going beyond the generic destructive flag.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the primary action and immediately followed by a key side-effect warning. Every word earns its place; there is no redundancy or vagueness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive tool with two parameters and no output schema, the description provides essential information: what it does, how it works, and what is not rolled back. It lacks explicit error conditions or post-cancel status, but sibling tools (box_job_status) can cover those, making it adequate for the context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema has 0% description coverage, and the description does not explicitly explain the parameters box_id and job_id beyond their names. The phrase 'running background job' hints that job_id must refer to an active job, but it does not elaborate on format, constraints, or how to obtain valid IDs. With low schema coverage, the description fails to compensate sufficiently.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action: 'Send SIGTERM to a running background job and its process group.' It identifies the specific verb (send SIGTERM), the resource (background job), and adds scope (process group). This distinguishes it from siblings like box_stop or box_job_start by focusing on cancellation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage: it is for canceling a running background job. However, it does not explicitly state when to use this over alternatives like box_stop or box_job_status, nor does it provide exclusions or prerequisites. The name and context make the purpose evident, but explicit guidance is missing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

box_job_logsRead background job logsB
Read-only

Read the tails of stdout and stderr for a background job.

ParametersJSON Schema
NameRequiredDescriptionDefault
box_idYes
job_idYes
max_charactersNo

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the description adds the 'tails' behavior (partial read). However, it does not explain limits, error behavior, or other side effects, but given the annotations, the additional context is sufficient for a basic rating.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence without fluff. It effectively communicates the core purpose in a minimal structure.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple, and annotations plus schema provide a good baseline. However, it lacks usage context and does not describe the response format (no output schema). The description is adequate but not comprehensive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the description does not mention any parameters. The schema provides some semantics through patterns and min/max, but the description fails to add meaningful explanation of box_id, job_id, or max_characters, which is required for low coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (read) and resource (tails of stdout/stderr for a background job), distinguishing it from sibling tools like box_job_status and box_job_cancel. It is specific and unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool or alternatives. The purpose implies it's for reading logs of background jobs, but there is no mention of prerequisites, exclusions, or when to prefer other tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

box_job_startStart background jobA
Destructive

Start a long-running shell job in a Box. The job runs independently after this tool returns and may modify the machine or external systems.

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdNo
box_idYes
commandYes

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses key behavioral traits beyond annotations: it states the job runs asynchronously and may modify the machine or external systems. This adds context beyond the destructive/open-world hints, though it does not cover return values or follow-up monitoring.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise, front-loaded sentences with no filler. The first sentence states the action, and the second adds critical behavioral context.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the essential purpose and async lifecycle but omits parameter semantics, return value information, and guidance on monitoring jobs. With sparse schema and no output schema, this is a noticeable gap, though annotations and sibling tool context partially compensate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description provides no explanation of box_id, command, or cwd. The description fails to add meaning beyond property names, leaving users to infer parameter purposes.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb 'Start' with a clear resource 'long-running shell job' and location 'in a Box'. It also distinguishes the tool from siblings by noting asynchronous execution ('runs independently'), which differentiates it from box_execute_command and job management tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'runs independently after this tool returns' provides clear context that this is for asynchronous, long-running tasks. However, it does not explicitly name alternatives or state when not to use it, leaving room for improvement.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

box_job_statusGet background job statusA
Read-only

Check whether a background job is running, succeeded, failed, or was cancelled.

ParametersJSON Schema
NameRequiredDescriptionDefault
box_idYes
job_idYes

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds the specific status outcomes (running, succeeded, failed, cancelled) but does not provide additional behavioral context such as how missing/invalid job IDs are handled or whether the response includes more than the status.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise, front-loaded sentence. Every word contributes information, and there is no repetition of the tool name or schema fields.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple status-check tool, the description is adequate: it lists the expected states and the annotations cover safety. However, the lack of parameter explanations and the absence of an output schema mean the agent must infer return format and edge-case behavior, leaving some gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description needs to compensate, but it does not explain the parameters at all. The parameter names (box_id, job_id) and pattern constraints provide some meaning, but the agent is left to guess the exact purpose and format beyond the regex patterns.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function with a specific verb ('check') and resource ('background job status'), and enumerates the possible states (running, succeeded, failed, cancelled). This distinguishes it from sibling tools like box_job_start, box_job_cancel, and box_job_logs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The usage context is implied: it is the only tool among siblings that reports job status, so the agent can infer it is for monitoring/polling. However, the description does not explicitly mention when to use it versus alternatives or any specific prerequisites or exceptions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

box_listList Box environmentsA
Read-only

Find the user's Box environments and inspect their current lifecycle states.

ParametersJSON Schema
NameRequiredDescriptionDefault
sortNodesc
limitNo
stateNoOptional comma-separated states such as ready,idle,running.
cursorNo

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is clear. The description adds the specific detail about returning lifecycle states, which is useful, but does not elaborate on pagination, sorting, or other behavioral aspects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence of 12 words, front-loaded with the action and resource. Every word earns its place, with no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description mentions the key output (lifecycle states) but does not address pagination, sorting, or filtering behavior despite the presence of limit/cursor/sort parameters and no output schema. It is adequate for a simple read-only list but leaves gaps for a user unfamiliar with the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 25% (only 'state' has a description). The tool description does not explain any parameters, failing to compensate for the low coverage. Parameters like 'cursor' and 'limit' are left entirely to the schema structure, which lacks semantic meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific verb ('Find') and resource ('user's Box environments') while adding the scope of inspecting 'current lifecycle states'. This distinguishes it from siblings like box_list_events (events) and box_get (specific environment).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The usage is implied: use it to find environments and their lifecycle states. However, it does not explicitly state when to prefer this over alternatives like box_get or box_list_events, nor does it mention any exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

box_list_eventsList Box eventsC
Read-only

Inspect recent lifecycle and work events emitted by a Box.

ParametersJSON Schema
NameRequiredDescriptionDefault
sortNodesc
typeNoOptional comma-separated event types.
limitNo
box_idYes
cursorNo

TDQS

C2.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the agent knows it's a safe read operation. The description adds that events are 'recent' and cover 'lifecycle and work' categories, but it does not disclose pagination behavior, sorting defaults, or any other side effects. This is adequate but not rich given the annotations cover the safety profile.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence with no wasted words. It is front-loaded with the verb and resource, making it immediately clear what the tool does.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 5 parameters (including a required box_id), no output schema, and low schema coverage, the description is too terse to be complete. It omits how to obtain a box_id, what sort/cursor/limit do, and how to interpret the event types. The annotations cover safety, but the description leaves too many operational details unaddressed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 20% (only 'type' is described). The description text adds no meaning for parameters like box_id, sort, limit, or cursor. It fails to compensate for the low schema coverage, leaving the agent without guidance on what these parameters mean or how to use them.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a clear verb 'Inspect' and specifies the resource as 'recent lifecycle and work events emitted by a Box', which tells the agent what the tool does. It is distinct from siblings like box_list (which lists boxes) and box_get (which gets box details), but it does not explicitly differentiate itself from these alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives, prerequisites (e.g., needing a valid box_id), or filtering/pagination strategies. It simply states what the tool does without context on appropriate usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

box_open_desktopOpen Box desktopA

Create a secret-bearing desktop streaming URL for the user to inspect the Box. Do not log, persist, or share the returned URL.

ParametersJSON Schema
NameRequiredDescriptionDefault
box_idYes
public_accessNoWhen true, returns a noVNC URL that does not require an access token.

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds crucial behavioral context that the URL is secret-bearing and must not be logged, persisted, or shared, which is not visible in annotations. It does not contradict readOnlyHint, openWorldHint, or destructiveHint, but lacks details on URL lifetime or revocation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences: the first states the purpose, the second an essential security directive. No wasted words and information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the core action and a key safety caveat, but omits output format, URL validity period, and whether a desktop session is started. While annotations help, the openWorldHint suggests side effects not explained.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description provides no parameter-level detail. Schema covers public_access but not box_id semantics; with 50% schema coverage, the description should compensate but does not, leaving box_id only inferable from context.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Create') and resource ('desktop streaming URL'), with a clear purpose ('for the user to inspect the Box'). This clearly distinguishes it from sibling tools like box_get or box_execute_command.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It implies a clear use case: when a user needs to visually inspect the Box. However, it does not explicitly state when not to use it or mention alternatives, so it stops short of full guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

box_read_fileRead Box fileB
Read-only

Read a file relative to the Box work directory. Results are capped for model safety.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes
box_idYes
encodingNoutf8
max_charactersNo

TDQS

B3.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds meaningful context by noting results are capped for model safety and that paths are relative to the Box work directory, which goes beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences with no redundancy. Front-loaded with the primary purpose, followed by the safety cap note. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has 4 parameters and no output schema, yet the description is minimal. It omits how the file content is returned, error behavior, and the role of encoding or max_characters beyond the cap. More detail would be needed for a complete understanding.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate. It clarifies 'path' as relative to the work directory and hints at 'max_characters' via the cap, but does not explain 'box_id' or 'encoding'. The schema provides patterns/enums for those, so the description adds partial value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Read a file relative to the Box work directory', which gives a specific verb and resource. It distinguishes from siblings like box_write_file and box_list, though it doesn't explicitly name alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given on when to use this tool versus alternatives like box_get or box_list. The description implies file content reading but provides no explicit context, exclusions, or comparisons.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

box_resumeResume BoxA

Resume an archived Box, restarting billable runtime on a fresh machine.

ParametersJSON Schema
NameRequiredDescriptionDefault
sizeNoOmit to preserve the current machine size.
box_idYes
no_envNo

TDQS

A3.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds behavioral context beyond annotations: 'billable runtime' indicates cost implications and 'fresh machine' suggests potential hardware reassignment. Annotations already flag the tool as non-read-only and non-destructive, and the description enriches understanding without contradicting them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, tight sentence with no filler. It front-loads the core action and outcome efficiently, earning a top score.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite a clear purpose, the description omits explanations for the 'no_env' parameter and does not clarify post-resumption behavior. With three parameters and no output schema, the text is too sparse to be fully complete, though it covers the main action.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 33% (only 'size' has a description), and the description does not explain any parameters. The meaning of 'no_env' and the effect of 'size' are left entirely to the schema, which is insufficient.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool resumes an archived Box, using the verb 'Resume' and specifying the resource as an 'archived Box.' It also mentions 'restarting billable runtime on a fresh machine,' which distinguishes it from sibling tools like box_stop or box_create.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool is for archived boxes, providing some context. However, it does not explicitly state when to use this tool over alternatives like box_create or box_fork, nor does it mention exclusions or alternative tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

box_stopStop and archive BoxA
Destructive

Stop a Box and snapshot its disk. force=true may irreversibly lose changes since the last successful snapshot and should only follow a refused normal stop.

ParametersJSON Schema
NameRequiredDescriptionDefault
forceNo
box_idYes

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already include destructiveHint=true, but the description adds important behavioral context: it snapshots the disk and warns that force=true may irreversibly lose changes since the last successful snapshot. This goes beyond the generic annotation, though it does not address authorization or the post-stop state.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences: the first states the core function, the second provides a critical safety caveat. No filler or redundancy, and the most important information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple destructive action with two parameters, the description covers the purpose, snapshot behavior, and force risk adequately. It lacks a brief note on prerequisites (e.g., box must be running) or an explicit contrast with box_resume, but the annotations and schema provide reasonable context. Overall it is sufficient without being exhaustive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds meaningful semantics for the force parameter (irreversibility, conditional use), which is beyond the schema's boolean default. However, the required box_id parameter is not described, though its name and pattern are self-explanatory. With low or partial schema coverage, the description only partially compensates for missing parameter explanations.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Stop a Box and snapshot its disk', providing a specific verb (stop) and resource (Box) with an additional outcome (snapshot). This distinguishes it from sibling tools like box_resume or box_list, making the purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit guidance on when force=true is appropriate ('only follow a refused normal stop'), which is useful. However, it does not explicitly state when to use this tool versus alternatives such as box_resume or box_fork, leaving the primary usage context implied rather than fully spelled out.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

box_write_fileWrite Box fileA
Destructive

Create or replace a file relative to the Box work directory. Existing content at the path is overwritten.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes
box_idYes
contentYes
encodingNoutf8

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds valuable behavioral detail beyond the annotations: it explicitly states that existing content at the path is overwritten, which aligns with destructiveHint=true. It also adds the path scoping constraint ('relative to the Box work directory'), giving context not present in annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, each with purpose: first states the action and scope, second discloses overwrite behavior. No filler or redundancy, and the verb is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the core write action and overwrite behavior, but given the lack of output schema and 4 parameters, it leaves out parameter semantics and any return/error info. It's minimally viable for a simple write but could be more complete with a note on what happens on success or path constraints.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description provides zero parameter information. The schema has 4 parameters (box_id, path, content, encoding) with 0% schema coverage, and the description mentions none of them. It fails to explain what 'content' or 'encoding' mean, leaving the agent to infer from names alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool creates or replaces a file relative to the Box work directory, using the specific verb+resource pair 'create or replace file'. This distinguishes it from siblings like box_read_file or box_create, and there is no ambiguity about its primary action.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context that this is for writing file content, and 'relative to the Box work directory' gives a boundary. It does not explicitly name alternatives or exclusions, but the phrase 'Existing content is overwritten' implies destructive write use, which contrasts with read tools. No misleading guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 15 tool updatesv0.1.0
    • First observedbox_create
    • First observedbox_execute_command
    • First observedbox_fork
    • First observedbox_get
    • First observedbox_job_cancel
    • First observedbox_job_logs
    • First observedbox_job_start
    • First observedbox_job_status
    • First observedbox_list
    • First observedbox_list_events
    • First observedbox_open_desktop
    • First observedbox_read_file
    • First observedbox_resume
    • First observedbox_stop
    • First observedbox_write_file

TDQS

A3.9/5.0

Scored across 15 tools

Disambiguation5/5

Each tool targets a distinct aspect of Box management: lifecycle operations (list, get, create, stop, resume, fork), file operations (read, write), command execution (execute_command, job_start), job monitoring (status, logs, cancel), plus events and desktop access. No two tools overlap in purpose.

Naming Consistency5/5

All tools follow a consistent box_verb_noun pattern, e.g., box_list, box_create, box_read_file, box_job_status. The naming is uniform and predictable, making it easy to infer what each tool does from its name alone.

Tool Count5/5

15 tools is a well-scoped count for a full-featured Box management server. Each tool covers a distinct necessary functionality without bloat, staying within the ideal range for a comprehensive tool set.

Completeness5/5

The tool set covers the full lifecycle of a Box environment including creation, inspection, stopping, resuming, and forking, plus file operations, command execution, background job management, events, and desktop access. No obvious gaps are present for the stated domain.

Maintenance

ActivitySlowing
ResponsivenessNo issues

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers